Hacking Instagram Accounts using OAuth vulnerability

'Nir Goldshlager' known as Facebook hacker and founder of Break Security , who reported many critical bugs in Facebook OAuth mechanism in past few months, today disclose a critical vulnerability in Instagram Oauth that allow an attacker to hack any account. Succesful hack allows attacker to acces...

WordPress Advanced XML Reader 0.3.4 XXE Injection

The WordPress plugin Advanced XML Reader v0.3.4 published here: http://wordpress.org/extend/plugins/advanced-xml-reader/ is susceptible to XXE XML eXternal Entity processing attacks. After installing the plugin on a Windows machine, I created a text file in the root of C:\ named "test.txt", which...

Xiuno BBS 2.0 reception authentication and authorization bypass vulnerability-vulnerability warning-the black bar safety net

In the clouds on the submission of the vendor of a vulnerability http://www.wooyun.org/bugs/wooyun-2010-019717 that is gorgeous ignored, after digging into it the vulnerability directly to the public 0×0 vulnerability overview 0×1 code analysis 0×2 PoC 0×0 vulnerability overview xiuno achieved...

Easy Icon Maker 5.01 - Crash (PoC)

Easy Icon Maker 5.01 - Crash PoC Exploit Title: Easy Icon Maker Version 5.01 Crash Poc vulnerability Date: 28-04-2013 Exploit Author: Asesino04 Vendor Homepage: link Software Link: http://www.icon-maker.com/iconmaker.exe Version: 5.01 & old versions Tested on: Windows 7 Introduction :...

AudioCover 0.8.18 Buffer Overflow

!/usr/bin/env ruby Exploit Title:AudioCoder 0.8.18 Buffer Overflow Exploit SEH Download link :http://www.mediacoderhq.com/getfile.htm?site=dl.mediacoderhq.com&file=AudioCoder-0.8.18.exe Vulnerable Product:AudioCoder Date found: 30.04.2013 Date publish: 01.05.2013 RST Author: metacom Version:...

Easy Icon Maker 5.01 - Crash (PoC)

Exploit Title: Easy Icon Maker Version 5.01 Crash Poc vulnerability Date: 28-04-2013 Exploit Author: Asesino04 Vendor Homepage: link Software Link: http://www.icon-maker.com/iconmaker.exe Version: 5.01 & old versions Tested on: Windows 7 Introduction : ----------------- Easy icon maker is sufferi...

AudioCoder Buffer Overflow Exploit (SEH)

Exploit for windows platform in category dos / poc !/usr/bin/env ruby Exploit Title:AudioCoder 0.8.18 Buffer Overflow Exploit SEH Download link :http://www.mediacoderhq.com/getfile.htm?site=dl.mediacoderhq.com&file=AudioCoder-0.8.18.exe Vulnerable Product:AudioCoder Date found: 30.04.2013 Date...

Vivotek IP Camera Buffer Overflow / Injection Vulnerabilities

Core Security Technologies Advisory - Vivotek IP Cameras suffer from information leak, buffer overflow, authentication, path traversal, and command injection vulnerabilities. Vulnerable are Vivotek PT7135 IP camera with firmware 0300a, Vivotek PT7135 IP camera with firmware 0400a, and possibly...

thinksns最新版微博某处配置不当可引发大规模蠕虫

简要描述： 详细说明： 首页发微博处未验证token，导致可以通过一个精心构造的表单使用户发一个带有链接的微博，点击链接后的用户又会干相同的事，一传十，十传百，将会引发大规模蠕虫。 漏洞证明： POC: None...

Elecard MPEG Player 5.8 Local PoC

Exploit for windows platform in category dos / poc !/usr/bin/python Exploit Title:Elecard MPEG Player 5.8 Local PoC Download link :www.elecard.com/assets/files/distribs/mpeg-player/EMpgPlayer.zip Product: Vulnerable Elecard MPEG Player,Elecard AVC HD Player RST Date found: 27.04.2013 Date publish...

Elecard MPEG Player 5.8 Buffer Overflow

!/usr/bin/python Exploit Title:Elecard MPEG Player 5.8 Local PoC Download link :www.elecard.com/assets/files/distribs/mpeg-player/EMpgPlayer.zip Product: Vulnerable Elecard MPEG Player,Elecard AVC HD Player RST Date found: 27.04.2013 Date publish: 27.04.2013 Author: metacom version:5.8.121004...

Critical flaw in Viber app allows full access to Smartphones

More than 50 millions of Smartphone users worldwide are facing a risk posed by a critical flaw in Viber app. The security company Bkav announced that it has found a way to gain full access to Android phones using the popular Viber messaging app. Unlike the Samsung lockscreen issue we reported on...

Foxit Reader 5.4.3.x 5.4.5.0124 - PDF XREF Parsing Denial of Service

Foxit Reader 5.4.3.x 5.4.5.0124 - PDF XREF Parsing Denial of Service Exploit Title: Foxit Reader 5.4.3. - 5.4.5.0124 - PDF Portable Document Format XREF Cross Reference Table parsing Denial of Service Vulnerability Date found: 2012.11.17 Date publish: 2013.04.17 Exploit Author: FuzzMyApp Vendor...

FirePHP Firefox Plugin 0.7.1 - Remote Command Execution

FirePHP Firefox Plugin 0.7.1 - Remote Command Execution Exploit Title: Firephp firefox plugin RCE Date: 17/04/2013 Exploit Author: Wireghoul Vendor Homepage: www.firephp.org Software Link: https://addons.mozilla.org/en-US/firefox/addon/firephp/versions/ Version: All versions up to and including...

JWPlayer 5 latest SWF XSS 0day analysis and POC improvements-bug warning-the black bar safety net

Original: Special Thx to small male students to the idea: Foreigners in 1, No. 6 published the jwplayer a not repairXSS 0day, the details of the fierce stamp here. jwplayer is currently the most widely used flash Player components, especially the many foreign online love action movies website...

Ruby Gem md2pdf Command Injection Vulnerability

Ruby Gem md2pdf suffers from a remote command injection vulnerability. Remote command injection md2pdf ruby gem 4/10/2013 Description: "creates pdf documents from markdown documents" https://rubygems.org/gems/md2pdf In md2pdf/converter.rb we see user supplied input being passed to the command lin...

phpVMS 2.1.934 / 2.1.935 SQL Injection

============================================================================================================= o phpVMS Virtual Airline Administration = SQL Injection Vulnerability Software : phpVMS Virtual Airline Administration Version : 2.1.934 & 2.1.935 Vendor : http://www.phpvms.net Author :...

phpVms Virtual Airline Administration 2.1.934/2.1.935 - SQL Injection

============================================================================================================= o phpVMS Virtual Airline Administration = SQL Injection Vulnerability Software : phpVMS Virtual Airline Administration Version : 2.1.934 & 2.1.935 Vendor : http://www.phpvms.net Author :...

phpVMS Virtual Airline Administration - SQL Injection Vulnerability

phpVMS is the most popular, free, virtual airline software, with support for various ACARS applications kACARS, FSACARS, XAcars, FS Flight Keeper, and FSPassengers, AJAX-driven administration panel, complete with financial reports, schedule management and various other features designed for...

phpVms Virtual Airline Administration 2.1.9342.1.935 - SQL Injection

phpVms Virtual Airline Administration 2.1.9342.1.935 - SQL Injection ============================================================================================================= o phpVMS Virtual Airline Administration = SQL Injection Vulnerability Software : phpVMS Virtual Airline Administration...